b5a3f6493a112e1bdfb2a17e89e3dd11b2ec36e62ffa9e6ca4e870bf3d909a1a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 116KB
Sample261014-bde6datv2r
SHA256 b5a3f6493a112e1bdfb2a17e89e3dd11b2ec36e62ffa9e6ca4e870bf3d909a1a
MD5 2ef5463158ec4c894cd249bc55d3acc3
SHA1 424a189cf8bda862e81054a935ed91fcabc3144f
SHA512 7ce12b11ebda1705af270082f42b37e2cb5aa6f893f6b679dd11782a296c11f30a2b0907f90a3a3cf0e3f3f54830358da8f5049617432d80cdb620852fbe3e28
SSDEEP 1536:d+ORgWAGFarYdzhiy5k4+oFtJiHmuIeEp5ADMPVdJUE22k+QzOlzx:dBRpBFiylftJi3c5AoPPOE221WO/
TLSH
T1F2C39E19B469CA72CC0306BE4811A314967B1F904227C6D3BFB5B9D5FEA2BC13E37166
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4796	New-Threat.exe
876	New-Threat.exe
1868	New-Threat.exe
2892	New-Threat.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AntiVirus = "C:\\Users\\Admin\\AppData\\Roaming\\New-Threat.exe"	New-Threat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiVirus = "C:\\Users\\Admin\\AppData\\Roaming\\New-Threat.exe"	New-Threat.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1760	1872	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 4796 set thread context of 876	4796	New-Threat.exe	102
PID 1868 set thread context of 2892	1868	New-Threat.exe	107

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\system33.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\windows\system33.exe	New-Threat.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	New-Threat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	New-Threat.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New-Threat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New-Threat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New-Threat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1760	1872	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 1872 wrote to memory of 1760	1872	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 1872 wrote to memory of 1760	1872	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 1872 wrote to memory of 1760	1872	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 1872 wrote to memory of 1760	1872	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 1760 wrote to memory of 4796	1760	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	98
PID 4796 wrote to memory of 876	4796	New-Threat.exe	102
PID 4796 wrote to memory of 876	4796	New-Threat.exe	102
PID 4796 wrote to memory of 876	4796	New-Threat.exe	102
PID 4796 wrote to memory of 876	4796	New-Threat.exe	102
PID 4796 wrote to memory of 876	4796	New-Threat.exe	102
PID 1868 wrote to memory of 2892	1868	New-Threat.exe	107
PID 1868 wrote to memory of 2892	1868	New-Threat.exe	107
PID 1868 wrote to memory of 2892	1868	New-Threat.exe	107
PID 1868 wrote to memory of 2892	1868	New-Threat.exe	107
PID 1868 wrote to memory of 2892	1868	New-Threat.exe	107

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Roaming\New-Threat.exe
    "C:\Users\Admin\AppData\Roaming\\New-Threat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Users\Admin\AppData\Roaming\New-Threat.exe
      "C:\Users\Admin\AppData\Roaming\\New-Threat.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:876

C:\Users\Admin\AppData\Roaming\New-Threat.exe
C:\Users\Admin\AppData\Roaming\New-Threat.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Roaming\New-Threat.exe
  C:\Users\Admin\AppData\Roaming\New-Threat.exe
  2⤵
  - Executes dropped EXE
  PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

l0v3e[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8J9OU7H5\l0v3e[1].htm
Size 2KB
SHA256 3b881317b90a5ffae8f5325b4bfc63a80e85e7d739eeca3012590ef00d83e070
MD5 609fdbac7bf2b4a91de837ea3dae4a73
SHA1 ff59ba6a930868ea3f325ab898563df2d8849470
SHA512 1565841c87f8679fd9dcb85ff06832d1d93865fd06fb11c2a94811013259f373d5224d95a195a87d8e0b2b07d689807c16ae3d3637bfdf626dea4adf57c8f38a
TLSH
T1F941A613658845330AA3F797E8647F5754D2E08E6E478151F98C0A648FEEF819C7225E
MD5 SHA1 SHA512 TLSH

Submit Download

New-Threat.exe

Path C:\Users\Admin\AppData\Roaming\New-Threat.exe
Size 116KB
SHA256 b5a3f6493a112e1bdfb2a17e89e3dd11b2ec36e62ffa9e6ca4e870bf3d909a1a
MD5 2ef5463158ec4c894cd249bc55d3acc3
SHA1 424a189cf8bda862e81054a935ed91fcabc3144f
SHA512 7ce12b11ebda1705af270082f42b37e2cb5aa6f893f6b679dd11782a296c11f30a2b0907f90a3a3cf0e3f3f54830358da8f5049617432d80cdb620852fbe3e28
SSDEEP 1536:d+ORgWAGFarYdzhiy5k4+oFtJiHmuIeEp5ADMPVdJUE22k+QzOlzx:dBRpBFiylftJi3c5AoPPOE221WO/
TLSH
T1F2C39E19B469CA72CC0306BE4811A314967B1F904227C6D3BFB5B9D5FEA2BC13E37166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system33.exe

Path C:\windows\system33.exe
Size 2KB
SHA256 348874012eab41083c26035413cc2d78172758390f2475895cf10e753c31f3f3
MD5 767870d94f46824c311d25b472cee9b0
SHA1 3962d9bc2e678af4b229880baeba3bd5724c7b00
SHA512 379f70171f3eb66851f2dc1c875177c53dd19e3f97cb402949b60f0ff168bf70752fc5ef4db1a29f2cd8f15824807be73a062d2c0e9de027156b3102aceb7dd4
TLSH
T15541D913659481370A63B797E4947B9710D2E08E6E468150F99C4B648FEEF819C3235E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/876-51-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-52-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-58-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-57-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-56-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-55-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-24-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-25-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-54-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-53-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-40-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-50-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-48-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/876-49-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1760-5-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1760-1-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1760-3-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1868-44-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1868-39-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1872-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1872-4-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4796-23-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4796-17-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads